===================================================================== CERT-Renater Note d'Information No. 2009/VULN004 _____________________________________________________________________ DATE : 07/01/2009 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running xterm. ====================================================================== http://lists.debian.org/debian-security-announce/2009/msg00002.html http://lists.debian.org/debian-security-announce/2009/msg00000.html ______________________________________________________________________ - ------------------------------------------------------------------------ Debian Security Advisory DSA-1694-2 security@debian.org http://www.debian.org/security/ Florian Weimer January 06, 2009 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : xterm Vulnerability : design flaw Problem type : local (remote) Debian-specific: no CVE Id(s) : CVE-2008-2383 Debian Bug : 510030 The xterm update in DSA-1694-1 disabled font changing as a precaution. However, users reported that they need this feature. The update in this DSA makes font shifting through escape sequences configurable, using a new allowFontOps X resource, and unconditionally enables font changing through keyboard sequences. For the stable distribution (etch), this problem has been fixed in version 222-1etch4. For the testing distribution (lenny), this problem has been fixed in version 235-2. For the unstable distribution (sid), this problem has been fixed in version 238-2. We recommend that you upgrade your xterm package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Source archives: http://security.debian.org/pool/updates/main/x/xterm/xterm_222.orig.tar.gz Size/MD5 checksum: 802986 bb77882a33083632a9c6c9de004a54fb http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4.diff.gz Size/MD5 checksum: 62608 acdbe0c106d90113e928b74c0fadd671 http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4.dsc Size/MD5 checksum: 1123 28cd750577ddd92fe4806385758a4f4a alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_alpha.deb Size/MD5 checksum: 438792 83ff3b4478eb19fb1924a492d461da15 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_amd64.deb Size/MD5 checksum: 417496 b2a1d139d6dec04ed090a931b7cac542 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_hppa.deb Size/MD5 checksum: 423078 4edd0ffec0c3c0f0fb94c17675dc3998 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_i386.deb Size/MD5 checksum: 406764 b22526bdba3a5013a7e218c64497efe4 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_ia64.deb Size/MD5 checksum: 510656 708c1978c6cb406a39d7506a490df2a3 mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_mips.deb Size/MD5 checksum: 429132 86547da89a11b4d9ef734a5586f38e90 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_mipsel.deb Size/MD5 checksum: 426508 3a875826919674e5833ec9687b922e03 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_powerpc.deb Size/MD5 checksum: 410788 51f94ca70632508db0a7e02b52ce7d3e s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_s390.deb Size/MD5 checksum: 423080 a73fa4e7aadaa0195772fee4791be0d2 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch4_sparc.deb Size/MD5 checksum: 411298 bc504d1dec3695fb614563c7e8f629bb These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ ______________________________________________________________________ - ------------------------------------------------------------------------ Debian Security Advisory DSA-1694-1 security@debian.org http://www.debian.org/security/ Florian Weimer January 02, 2009 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : xterm Vulnerability : design flaw Problem type : local (remote) Debian-specific: no CVE Id(s) : CVE-2008-2383 Debian Bug : 510030 Paul Szabo discovered that xterm, a terminal emulator for the X Window System, places arbitrary characters into the input buffer when displaying certain crafted escape sequences (CVE-2008-2383). As an additional precaution, this security update also disables font changing, user-defined keys, and X property changes through escape sequences. For the stable distribution (etch), this problem has been fixed in version 222-1etch3. For the unstable distribution (sid), this problem will be fixed soon. We recommend that you upgrade your xterm package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Source archives: http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3.dsc Size/MD5 checksum: 1123 3bcc850fe7c9057e5d5d03617cc95195 http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3.diff.gz Size/MD5 checksum: 61664 f1e11e4f4c85db1e2ffa67c5d132d2e6 http://security.debian.org/pool/updates/main/x/xterm/xterm_222.orig.tar.gz Size/MD5 checksum: 802986 bb77882a33083632a9c6c9de004a54fb alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_alpha.deb Size/MD5 checksum: 437394 2a16b16a6ed79a908987769b9b5a68d8 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_amd64.deb Size/MD5 checksum: 416434 46ba9b4430c313464afeaa856d02f09a arm architecture (ARM) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_arm.deb Size/MD5 checksum: 412020 9119d878ffedf54c843ec84a98022a3d hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_hppa.deb Size/MD5 checksum: 421890 9b3326921fbbd0ba014b3717b20c53fb i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_i386.deb Size/MD5 checksum: 403908 f54263828a01af2af86f25c1fedc7aa6 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_ia64.deb Size/MD5 checksum: 509374 052861cf2a23d7a414c038d510fc7f01 mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_mips.deb Size/MD5 checksum: 428858 63615939a4de2f4e3ba0cc61adbf0e47 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_mipsel.deb Size/MD5 checksum: 425604 9d18da53eea366eb2688dfe629d95e82 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_powerpc.deb Size/MD5 checksum: 409986 824e743d4a6a1abeb5c1fdc0a9e7d006 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_s390.deb Size/MD5 checksum: 422196 9b78491ef8fb34da8d5e183e91fc6c65 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_sparc.deb Size/MD5 checksum: 409994 e284b9163d0da06f932f8e243ccaee2b These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================